MCP server that scans dependency manifests and reports known vulnerabilities
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"dep-guard-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Dep Guard MCP - Dependency Vulnerability Scanner 🔐 A fast, zero-config Model Context Protocol (MCP) server that scans Python, Node.js, Java/Spring, and PHP dependency manifests for known vulnerabilities. ## Status: ⚡ Week 2 Complete - ✅ All tests passing - ✅ MCP server fully functional - ✅ Ready for Claude Desktop integration - ✅ Production-ready code - ✅ Free GitHub Advisory integration - ✅ CLI support for local and CI usage    ## Features - 📦 **Multi-Language Support**: - Python (`requirements.txt`, `pyproject.toml`) - Node.js (`package.json`) - Java/Spring (`pom.xml`, `build.gradle`, `build.gradle.kts`) - PHP (`composer.json`) - 🎯 **Zero Config**: Automatic dependency discovery and scanning - ⚡ **Multi-source Advisories**: - OSV API (free) - GitHub Advisory API (free public endpoint, optional `GITHUB_TOKEN` for higher rate limits) - 🔧 **3 Core Tools**: - `scan_dependencies(target_path)` - Scan a project for vulnerabilities - `health_check()` - Verify server status - `get_supported_files()` - List scannable formats - 🎨 **Clean Output**: JSON-formatted vulnerability reports with severity levels ## CLI Usage (Week 2) ```bash # health check dep-guard-scan health # list supported files dep-guard-scan supported-files # scan and print JSON dep-guard-scan scan /path/to/project # scan and write report file dep-guard-scan scan /path/to/project --output report.json # fail CI if severity threshold is met dep-guard-scan scan /path/to/project --fail-on-severity high # disable GitHub advisories source dep-guard-scan scan /path/to/project --no-github-advisories ``` ## Week 3 Launch Prep ### GitHub Workflows This repo now includes: - CI workflow: `.g…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.